> ## Documentation Index > Fetch the complete documentation index at: https://docs.replit.com/llms.txt > Use this file to discover all available pages before exploring further. # Add secrets to environments > Connect external secrets managers to your development environment using Replit's open-source OIDC modules, short-lived credentials, and provider policies. Choose your provider below and give Replit its configuration to connect your secrets manager and save it to your [reusable environment](https://docs.replit.com/build/code/create-reusable-environment.md). Replace the example identifiers with your development resources and configure the provider's trust and permissions first. The modules configure short-lived provider credentials; they do not automatically load secrets into your app. ## Connect your secrets manager **AWS Secrets Manager** ```yaml theme={null} repos: - repo: https://github.com/replit/dev-modules ref: f9ec152dd804895d59cb01fa71ee01864d932c40 path: dev-modules build: - run: >- bash ./dev-modules/aws-oidc/build.sh --role-arn=arn:aws:iam::123456789012:role/replit-development --region=us-east-1 ``` Prerequisites: Register `https://sts.replit.com` as an AWS OIDC provider with audience `sts.amazonaws.com`, and create the role above. Restrict its trust to your Replit workspace and grant read access to the required secrets. See the [detailed AWS instructions](https://github.com/replit/dev-modules/tree/f9ec152dd804895d59cb01fa71ee01864d932c40/aws-oidc). Ask Agent to retrieve the secrets your app needs from the connected provider and configure your app to use them. Tell Agent where to look, such as a specific project, vault, or secret path. **Infisical** ```yaml theme={null} repos: - repo: https://github.com/replit/dev-modules ref: f9ec152dd804895d59cb01fa71ee01864d932c40 path: dev-modules build: - run: >- bash ./dev-modules/infisical-oidc/build.sh --identity-id="" --project-id="" --environment=dev ``` Prerequisites: Create a machine identity with JWT authentication using Replit's JWKS, audience `infisical`, and your [workspace's `org_id`](https://github.com/replit/dev-modules/tree/f9ec152dd804895d59cb01fa71ee01864d932c40#how-oidc-works). Give it read access to the intended project's development environment and paths. See the [detailed Infisical instructions](https://github.com/replit/dev-modules/tree/f9ec152dd804895d59cb01fa71ee01864d932c40/infisical-oidc). Ask Agent to retrieve the secrets your app needs from the connected provider and configure your app to use them. Tell Agent where to look, such as a specific project, vault, or secret path. **Azure Key Vault** ```yaml theme={null} repos: - repo: https://github.com/replit/dev-modules ref: f9ec152dd804895d59cb01fa71ee01864d932c40 path: dev-modules build: - run: >- bash ./dev-modules/azure-oidc/build.sh --client-id="" --tenant-id="" --subscription-id="" ``` Prerequisites: Create a managed identity or app registration trusting `https://sts.replit.com`, with audience `api://AzureADTokenExchange` and subject [`//replit.com/customer//org/`](https://github.com/replit/dev-modules/tree/f9ec152dd804895d59cb01fa71ee01864d932c40#how-oidc-works). Grant it read access to the development Key Vault secrets. See the [detailed Azure instructions](https://github.com/replit/dev-modules/tree/f9ec152dd804895d59cb01fa71ee01864d932c40/azure-oidc). Ask Agent to retrieve the secrets your app needs from the connected provider and configure your app to use them. Tell Agent where to look, such as a specific project, vault, or secret path. **HashiCorp Vault** ```yaml theme={null} repos: - repo: https://github.com/replit/dev-modules ref: f9ec152dd804895d59cb01fa71ee01864d932c40 path: dev-modules build: - run: >- bash ./dev-modules/vault-oidc/build.sh --address=https://vault.example.com --role=replit-development ``` Prerequisites: Create a JWT role trusting Replit, bound to your [workspace's `org_id`](https://github.com/replit/dev-modules/tree/f9ec152dd804895d59cb01fa71ee01864d932c40#how-oidc-works) and the Vault hostname as its audience. Give it read access to the intended secret paths, and ensure the Vault server is reachable from the environment. See the [detailed Vault instructions](https://github.com/replit/dev-modules/tree/f9ec152dd804895d59cb01fa71ee01864d932c40/vault-oidc). Ask Agent to retrieve the secrets your app needs from the connected provider and configure your app to use them. Tell Agent where to look, such as a specific project, vault, or secret path. **Google Secret Manager** ```yaml theme={null} repos: - repo: https://github.com/replit/dev-modules ref: f9ec152dd804895d59cb01fa71ee01864d932c40 path: dev-modules build: - run: >- bash ./dev-modules/gcp-oidc/build.sh --workload-identity-provider=projects/123456789/locations/global/workloadIdentityPools/replit/providers/replit-oidc --service-account=replit-dev@my-project.iam.gserviceaccount.com --project=my-project ``` Prerequisites: Create a Google workload identity provider trusting `https://sts.replit.com`, restricted to your Replit workspace. Its allowed audience must match `//iam.googleapis.com/`, using the full resource name passed to `--workload-identity-provider`. Allow it to impersonate the service account above, and grant that account Secret Manager access. See the [detailed Google instructions](https://github.com/replit/dev-modules/tree/f9ec152dd804895d59cb01fa71ee01864d932c40/gcp-oidc). Ask Agent to retrieve the secrets your app needs from the connected provider and configure your app to use them. Tell Agent where to look, such as a specific project, vault, or secret path. > [!NOTE] > > For non-interactive app commands, ask Agent to load `~/.config/replit-oidc/env.sh` and follow the runtime instructions in the linked provider README. > CLI authentication does not guarantee SDK authentication or credential refresh. Vault and Infisical CLI helpers do not supply credentials to unrelated SDK processes. > **Need a secret for only this chat?** > > Ask Agent to add a secret by name, without typing its value in your message. For example: > > ```text theme={null} > This app needs DEVELOPMENT_API_KEY. Ask me to add it securely for this chat. > ``` > > Agent can open a secure elicitation form for you to enter the value. The secret is stored securely and scoped to the private chat, rather than placed in your prompt or committed to Git. Use a development credential with only the permissions required; confirm the variable name and scope shown by the form before submitting. Do not assume a chat-scoped secret is available in a different chat or in a reusable environment build. > > ![Secure secret-entry form with an empty value field.](https://mintcdn.com/replit/Scz0QdkCm-76dARz/images/code-contributions/chat-secret-elicitation.png?fit=max\&auto=format\&n=Scz0QdkCm-76dARz\&q=85\&s=0a259e2853c5ec254f1bfb9c58de097b) > > Alternatively, select **+** in the editor tab bar, then **Secrets**. > > ![The editor's new-tab menu with Secrets highlighted.](https://mintcdn.com/replit/ZvLiuMLrojYoqf3I/images/code-contributions/open-secrets-tab.jpg?fit=max\&auto=format\&n=ZvLiuMLrojYoqf3I\&q=85\&s=9dfd78422324f9c2c7742688b6ab8c81) > > Select **New Secret**, enter the **Key** and **Value**, and select **Add Secret**. Enter credentials in the form, never in chat. > > ![The Add Secret form with Key and empty Value fields.](https://mintcdn.com/replit/bwyNlFMrtiNdFQiG/images/code-contributions/add-secret-form.jpg?fit=max\&auto=format\&n=bwyNlFMrtiNdFQiG\&q=85\&s=128c3e3878cdfb9e92c569a08d729c07)